BhutanCybersecurity Code of Practice, Threat Information Sharing and Incident Reporting Structure
Bhutan InfoComm and Media Authority Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under section 58 of… the Information, Communications and Media Act of Bhutan 2018), clauses 11.7 and 12.1
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.bicma.gov.bt/wp-content/uploads/2024/10/Code-of-Practice-for-Information-Security-Cybersecurity-and-privacy-Protection-for-ICT-S…In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a licensed telecom service provider and any other licensed ICT service provider that has critical information infrastructure in Bhutan (reached by declaring that you provide telecom services or operate an essential service).
- Establish and implement mechanisms and processes to share information on cybersecurity threats and vulnerabilities, and on measures that can be taken in response to them, with the relevant Authorities for threat monitoring and analysis (clause 11.7(b)).
- Make sure your Cybersecurity Incident Response Plan includes an incident reporting structure that guides you on compliance with your reporting obligations under the Information, Communications and Media Act of Bhutan 2018 and any other laws and regulations (clause 12.1(c)(i)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bhutan InfoComm and Media Authority, which may by order secure compliance by a licensee in contravention of the terms and conditions of its license, including by payment of a fine.
Settledness
- As of
- Open questions
- Does a breach of the Code, issued under section 58 of the Act, fall within section 127 of the Act, which reaches a licensee in contravention of the terms and conditions of its license?
What this law does
The Code applies to the Telecom Service Providers and other ICT Service providers having critical information infrastructure. The Code requires a licensee to establish and implement mechanisms and processes to share information on cybersecurity threats and vulnerabilities, and on measures that can be taken in response to them, with the relevant Authorities for threat monitoring and analysis.
The Code requires the Cybersecurity Incident Response Plan to include an incident reporting structure that guides the licensee on compliance with its reporting obligations under the Act and any other laws and regulations. Section 127 of the Act provides that where a licensee is in contravention of the terms and conditions of its license, the Authority shall by an order make such provision, including payment of fine, as it appears necessary for the purpose of securing compliance.
When LexLint raises it
When your app profile says your app runs an essential service or provides telecom services.